suricata
app-layer.c File Reference
#include "suricata-common.h"
#include "app-layer.h"
#include "app-layer-parser.h"
#include "app-layer-protos.h"
#include "app-layer-expectation.h"
#include "app-layer-ftp.h"
#include "app-layer-detect-proto.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp-private.h"
#include "stream-tcp-inline.h"
#include "stream-tcp.h"
#include "flow.h"
#include "flow-util.h"
#include "flow-private.h"
#include "ippair.h"
#include "util-debug.h"
#include "util-print.h"
#include "util-profiling.h"
#include "util-validate.h"
#include "decode-events.h"
#include "app-layer-htp-mem.h"
#include "app-layer-dns-common.h"
#include "pkt-var.h"
#include "stream-tcp-util.h"
#include "stream.h"
#include "util-unittest.h"
Include dependency graph for app-layer.c:

Go to the source code of this file.

Data Structures

struct  AppLayerThreadCtx_
 This is for the app layer in general and it contains per thread context relevant to both the alpd and alp. More...
 
struct  AppLayerCounterNames_
 
struct  AppLayerCounters_
 

Macros

#define MAX_COUNTER_SIZE   64
 
#define IPPROTOS_MAX   2
 
#define TEST_START
 
#define TEST_END
 

Typedefs

typedef struct AppLayerCounterNames_ AppLayerCounterNames
 
typedef struct AppLayerCounters_ AppLayerCounters
 

Functions

void AppLayerSetupCounters (void)
 
void AppLayerDeSetupCounters (void)
 
void AppLayerIncTxCounter (ThreadVars *tv, Flow *f, uint64_t step)
 
int AppLayerHandleTCPData (ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream **stream, uint8_t *data, uint32_t data_len, uint8_t flags)
 handle TCP data for the app-layer. More...
 
int AppLayerHandleUdp (ThreadVars *tv, AppLayerThreadCtx *tctx, Packet *p, Flow *f)
 Handle a app layer UDP message. More...
 
AppProto AppLayerGetProtoByName (char *alproto_name)
 Given a protocol string, returns the corresponding internal protocol id. More...
 
const char * AppLayerGetProtoName (AppProto alproto)
 Given the internal protocol id, returns a string representation of the protocol. More...
 
void AppLayerListSupportedProtocols (void)
 
int AppLayerSetup (void)
 Setup the app layer. More...
 
int AppLayerDeSetup (void)
 De initializes the app layer. More...
 
AppLayerThreadCtxAppLayerGetCtxThread (ThreadVars *tv)
 Creates a new app layer thread context. More...
 
void AppLayerDestroyCtxThread (AppLayerThreadCtx *app_tctx)
 Destroys the context created by AppLayeGetCtxThread(). More...
 
void AppLayerProfilingResetInternal (AppLayerThreadCtx *app_tctx)
 
void AppLayerProfilingStoreInternal (AppLayerThreadCtx *app_tctx, Packet *p)
 
void AppLayerRegisterGlobalCounters (void)
 HACK to work around our broken unix manager (re)init loop. More...
 
void AppLayerRegisterThreadCounters (ThreadVars *tv)
 Registers per flow counters for all protocols. More...
 
void AppLayerUnittestsRegister (void)
 

Variables

AppLayerCounterNames applayer_counter_names [FLOW_PROTO_APPLAYER_MAX][ALPROTO_MAX]
 
AppLayerCounters applayer_counters [FLOW_PROTO_APPLAYER_MAX][ALPROTO_MAX]
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t
Anoop Saldanha anoop.nosp@m.sald.nosp@m.anha@.nosp@m.gmai.nosp@m.l.com

Generic App-layer functions

Definition in file app-layer.c.

Macro Definition Documentation

#define IPPROTOS_MAX   2

Definition at line 879 of file app-layer.c.

Referenced by AppLayerRegisterThreadCounters(), and AppLayerSetupCounters().

#define MAX_COUNTER_SIZE   64

Definition at line 74 of file app-layer.c.

#define TEST_END
Value:
StreamTcpSessionClear(p->flow->protoctx);\
StreamTcpThreadDeinit(&tv, (void *)stt); \
void StatsThreadCleanup(ThreadVars *tv)
Definition: counters.c:1297
void StreamTcpFreeConfig(char quiet)
Definition: stream-tcp.c:668
#define TRUE
#define FLOW_DESTROY(f)
Definition: flow-util.h:121
void StreamTcpSessionClear(void *ssnptr)
Function to return the stream back to the pool. It returns the segments in the stream to the segment ...
Definition: stream-tcp.c:248
#define SCFree(a)
Definition: util-mem.h:322
TmEcode StreamTcpThreadDeinit(ThreadVars *tv, void *data)
Definition: stream-tcp.c:5245
#define PACKET_DESTRUCTOR(p)
Cleanup a packet so that we can free it. No memset needed..
Definition: decode.h:823

Definition at line 1051 of file app-layer.c.

#define TEST_START

Definition at line 968 of file app-layer.c.

Typedef Documentation

Function Documentation

int AppLayerDeSetup ( void  )

De initializes the app layer.

Includes de initializing protocol detection and the protocol parser.

Definition at line 808 of file app-layer.c.

References AppLayerDeSetupCounters(), AppLayerParserDeSetup(), AppLayerProtoDetectDeSetup(), SCEnter, and SCReturnInt.

Referenced by GlobalsInitPreConfig().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerDeSetupCounters ( void  )

Definition at line 953 of file app-layer.c.

Referenced by AppLayerDeSetup().

Here is the caller graph for this function:

void AppLayerDestroyCtxThread ( AppLayerThreadCtx tctx)

Destroys the context created by AppLayeGetCtxThread().

Parameters
tctxPointer to the thread context to destroy.

Definition at line 842 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, AppLayerParserThreadCtxFree(), AppLayerProtoDetectDestroyCtxThread(), SCEnter, SCFree, and SCReturn.

Referenced by AppLayerGetCtxThread(), DecodeThreadVarsFree(), DetectDceOpnumRegister(), DetectReplaceFreeInternal(), and StreamTcpReassembleFreeThreadCtx().

Here is the call graph for this function:

Here is the caller graph for this function:

AppLayerThreadCtx* AppLayerGetCtxThread ( ThreadVars tv)

Creates a new app layer thread context.

Return values
Pointerto the newly create thread context, on success; NULL, on failure.

Definition at line 820 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, AppLayerDestroyCtxThread(), AppLayerParserThreadCtxAlloc(), AppLayerProtoDetectGetCtxThread(), SCEnter, SCMalloc, and SCReturnPtr.

Referenced by DecodeThreadVarsAlloc(), DetectFragBitsRegister(), DetectReplaceFreeInternal(), and StreamTcpReassembleInitThreadCtx().

Here is the call graph for this function:

Here is the caller graph for this function:

AppProto AppLayerGetProtoByName ( char *  alproto_name)

Given a protocol string, returns the corresponding internal protocol id.

Parameters
Theinternal protocol id.

Definition at line 759 of file app-layer.c.

References AppLayerProtoDetectGetProtoByName(), SCEnter, and SCReturnCT.

Referenced by DetectAppLayerEventRegister(), and SigMatchListSMBelongsTo().

Here is the call graph for this function:

Here is the caller graph for this function:

const char* AppLayerGetProtoName ( AppProto  alproto)

Given the internal protocol id, returns a string representation of the protocol.

Parameters
alprotoThe internal protocol id.
Return values
Stringrepresentation of the protocol.

Definition at line 766 of file app-layer.c.

References AppLayerProtoDetectGetProtoName(), SCEnter, and SCReturnCT.

Referenced by AppLayerListSupportedProtocols(), AppLayerParserParse(), AppLayerSetupCounters(), DetectLuaRegister(), and JsonTlsLogJSONExtended().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerHandleTCPData ( ThreadVars tv,
TcpReassemblyThreadCtx ra_ctx,
Packet p,
Flow f,
TcpSession ssn,
TcpStream **  stream,
uint8_t *  data,
uint32_t  data_len,
uint8_t  flags 
)
int AppLayerHandleUdp ( ThreadVars tv,
AppLayerThreadCtx tctx,
Packet p,
Flow f 
)

Handle a app layer UDP message.

Handles an udp chunk.

If the protocol is yet unknown, the proto detection code is run first.

Parameters
dp_ctxThread app layer detect context
flocked flow
pUDP packet
Return values
0ok
-1error

Definition at line 688 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, Flow_::alproto, ALPROTO_FAILED, ALPROTO_UNKNOWN, AppLayerParserParse(), AppLayerProtoDetectGetProto(), FLOW_PKT_TOSERVER, Packet_::flowflags, FlowSwap(), PACKET_PROFILING_APP_END, PACKET_PROFILING_APP_PD_END, PACKET_PROFILING_APP_PD_START, PACKET_PROFILING_APP_START, PACKET_PROFILING_APP_STORE, PacketSwap(), Packet_::payload, Packet_::payload_len, SCEnter, SCLogDebug, SCReturnInt, STREAM_TOCLIENT, STREAM_TOSERVER, and SWAP_FLAGS.

Here is the call graph for this function:

void AppLayerIncTxCounter ( ThreadVars tv,
Flow f,
uint64_t  step 
)

Definition at line 113 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, AppLayerThreadCtx_::alproto, Flow_::alproto, ALPROTO_FAILED, Flow_::alproto_tc, Flow_::alproto_ts, ALPROTO_UNKNOWN, APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER, Packet_::app_layer_events, APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION, APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS, APPLAYER_PROTO_DETECTION_SKIPPED, APPLAYER_WRONG_DIRECTION_FIRST_DATA, AppLayerDecoderEventsSetEventRaw(), AppLayerParserGetFirstDataDir(), AppLayerParserGetStreamDepth(), AppLayerParserParse(), AppLayerProtoDetectGetProto(), AppProtoToString(), BUG_ON, TcpSession_::client, AppLayerCounters_::counter_tx_id, TcpSession_::data_first_seen_dir, EngineModeIsIPS(), TcpStream_::flags, TcpSession_::flags, flags, Flow_::flags, Packet_::flags, FLOW_IS_PM_DONE, FLOW_IS_PP_DONE, FLOW_PKT_TOCLIENT, FLOW_PKT_TOSERVER, FLOW_PROTO_DETECT_TC_DONE, FLOW_PROTO_DETECT_TS_DONE, FLOW_RESET_PE_DONE, FLOW_RESET_PM_DONE, FLOW_RESET_PP_DONE, FlowCleanupAppLayer(), Packet_::flowflags, FlowSwap(), TcpStream_::isn, TcpStream_::last_ack, likely, PACKET_PROFILING_APP_END, PACKET_PROFILING_APP_PD_END, PACKET_PROFILING_APP_PD_START, PACKET_PROFILING_APP_START, PacketSwap(), Packet_::pcap_cnt, PKT_PROTO_DETECT_TC_DONE, PKT_PROTO_DETECT_TS_DONE, PrintRawDataFp(), Flow_::proto, Flow_::protoctx, Flow_::protomap, SCLogDebug, TcpSession_::server, StatsAddUI64(), STREAM_TOCLIENT, STREAM_TOSERVER, STREAMTCP_FLAG_MIDSTREAM, STREAMTCP_FLAG_MIDSTREAM_SYNACK, STREAMTCP_STREAM_FLAG_GAP, STREAMTCP_STREAM_FLAG_NOREASSEMBLY, StreamTcpDisableAppLayer(), StreamTcpInlineMode(), StreamTcpReassembleAppLayer(), StreamTcpResetStreamFlagAppProtoDetectionCompleted, StreamTcpSetStreamFlagAppProtoDetectionCompleted, SWAP_FLAGS, TcpSessionSetReassemblyDepth(), UPDATE_DIR_OPPOSING, and UPDATE_DIR_PACKET.

Referenced by AppLayerParserParse().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerListSupportedProtocols ( void  )

Definition at line 773 of file app-layer.c.

References AppLayerThreadCtx_::alproto, ALPROTO_MAX, AppLayerGetProtoName(), AppLayerProtoDetectSupportedAppProtocols(), SCEnter, and SCReturn.

Referenced by ListAppLayerProtocols().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerProfilingResetInternal ( AppLayerThreadCtx app_tctx)

Definition at line 858 of file app-layer.c.

References PACKET_PROFILING_APP_RESET.

void AppLayerProfilingStoreInternal ( AppLayerThreadCtx app_tctx,
Packet p 
)

Definition at line 863 of file app-layer.c.

References PACKET_PROFILING_APP_STORE.

void AppLayerRegisterGlobalCounters ( void  )

HACK to work around our broken unix manager (re)init loop.

Definition at line 870 of file app-layer.c.

References ExpectationGetCounter(), FTPMemcapGlobalCounter(), FTPMemuseGlobalCounter(), HTPMemcapGlobalCounter(), HTPMemuseGlobalCounter(), and StatsRegisterGlobalCounter().

Referenced by PreRunInit().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerRegisterThreadCounters ( ThreadVars tv)

Registers per flow counters for all protocols.

Definition at line 926 of file app-layer.c.

References AppLayerThreadCtx_::alproto, ALPROTO_FAILED, ALPROTO_MAX, AppLayerProtoDetectSupportedAppProtocols(), AppLayerCounters_::counter_id, AppLayerCounters_::counter_tx_id, FlowGetProtoMapping(), IPPROTOS_MAX, and StatsRegisterCounter().

Here is the call graph for this function:

int AppLayerSetup ( void  )

Setup the app layer.

Includes protocol detection setup and the protocol parser setup.

Return values
0On success.
-1On failure.

Definition at line 793 of file app-layer.c.

References AppLayerParserRegisterProtocolParsers(), AppLayerParserSetup(), AppLayerProtoDetectPrepareState(), AppLayerProtoDetectSetup(), AppLayerSetupCounters(), SCEnter, and SCReturnInt.

Referenced by ListAppLayerProtocols(), ListKeywords(), PostRunDeinit(), and RunUnittests().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerSetupCounters ( void  )

Definition at line 880 of file app-layer.c.

References AppLayerThreadCtx_::alproto, ALPROTO_FAILED, ALPROTO_MAX, AppLayerGetProtoName(), AppLayerParserProtoIsRegistered(), AppLayerProtoDetectSupportedAppProtocols(), FlowGetProtoMapping(), IPPROTOS_MAX, and str.

Referenced by AppLayerSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerUnittestsRegister ( void  )

Definition at line 2621 of file app-layer.c.

References SCEnter, SCReturn, and UtRegisterTest().

Here is the call graph for this function:

Variable Documentation

Definition at line 86 of file app-layer.c.

Definition at line 88 of file app-layer.c.